App Store Connect upload failed: "ITMS-90809 deprecated API usage" error how to fix

TL;DR

Find the code or third-party SDK still calling the deprecated API Apple flagged, usually UIWebView, and update or remove it, then upload a new build. Search the binary and the project for the deprecated symbols, upgrade offending pods or SDKs to versions that dropped them, and confirm with a symbol scan of the final archive. Apple rejects new submissions that still link the deprecated API.

ITMS-90809 deprecated API usage

Use this when

• App Store Connect returns ITMS-90809 after upload or in the processing email.
• Your app or an embedded SDK still references UIWebView.
• A previously accepted app started failing after an SDK or OS deadline passed.

Not for this skill when

• The rejection is a warning-only ITMS notice on an existing live build. Warnings differ from hard rejections.
• The deprecated call is in your own networking code with no SDK involved. That needs a code migration, not only an SDK update.

Steps

1. Read the full App Store Connect email, which names the deprecated API, and note whether it is a rejection or a future-deadline warning. Verify: you have the exact API name written down, most commonly UIWebView
2. Search the project source and Podfile.lock or Package.resolved for libraries known to embed the API, including old analytics and ad SDKs. Verify: every suspect dependency is listed with its current version
3. Scan the archived app binary for the deprecated class symbols to see whether your code or a framework contributes them. Verify: the scan names the specific framework or your app binary as the source
4. Upgrade each offending SDK to the first version that removed the API, or remove the dependency if it is abandoned. Verify: dependency files resolve and the project builds with the new versions
5. If the symbol comes from your own code, replace UIWebView with WKWebView and adjust delegates for the modern API. Verify: the app renders the same web content in the simulator with no UIWebView references left
6. Archive, re-scan the new binary, and upload a build with a higher build number. Verify: the symbol scan is clean and App Store Connect accepts the build without ITMS-90809
7. Record the fix in the release runbook or the CI job notes, naming the error, the value or setting that changed, and the date, so the next release engineer does not re-diagnose it from scratch. Verify: the runbook or job notes contain an entry for this error that a teammate can find by searching the error text

Why it happens

Apple retires old APIs on a published schedule and enforces the retirement at upload validation. UIWebView is the classic case: it lingered inside popular SDKs long after developers stopped calling it directly, so the rejection often points at a binary that contains the class even though no source file mentions it. The validator checks linked symbols, not intent.

In practice this failure is rarely a one-off. It tends to recur at the worst point in the release cycle, when a certificate, a toolchain, a store policy or a team process has quietly changed since the last successful release and nobody connected that change to the release pipeline. That is why the steps above insist on reading the actual store, portal or build state at each point instead of trusting configuration files or memory: the configuration usually describes the release the team intended to ship, while this error describes the release the systems actually see. Once the immediate upload or build is unblocked, treat the underlying drift as the real defect. Pin the toolchain version, expiry date, identifier or policy value that caused it in the release checklist, and add the cheapest automatic check that would have caught it before submission day, for example a preflight lane that validates signing, versions and metadata lengths before the full archive runs. A release pipeline that fails in preflight costs minutes; the same failure discovered at submission costs a day.

Variants and edge cases

ITMS-90809 UIWebView rejection fix

The overwhelmingly common variant; upgrade the SDK embedding UIWebView. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

deprecated API usage App Store Connect upload failed

Generic phrasing used when the email has not been read yet. Always read it to get the API name. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Edge case: false positive from strings

A class name inside a string or comment can trip naive scans. The binary symbol scan in step 3 separates real linkage from text mentions. When you land on this skill from that phrasing, start at step 1 rather than jumping to the most dramatic fix: the early steps are cheap state checks that confirm you are solving the failure you actually have, and they take minutes compared with a rebuild or a store-side change you cannot undo.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Q4vSYlX9cxcoRI4s4whjAg